chore(deps): bump org.apache.pulsar:pulsar-client from 3.2.2 to 4.2.2

[dependabot]

Bumps org.apache.pulsar:pulsar-client from 3.2.2 to 4.2.2.

Release notes

Sourced from org.apache.pulsar:pulsar-client's releases.

v4.2.2

2026-06-08

Library updates

• [fix][sec] Bump org.asynchttpclient:async-http-client from 2.14.5 to 2.15.0 (#25818)
• [fix][sec] Upgrade commons-configuration2 to 2.15.0 to address CVE-2026-45205 (#25844)
• [fix][sec] Upgrade Netty to 4.1.133.Final to address CVEs (#25670)
• [improve][misc] Upgrade Netty to 4.1.134 (#25870)
• [fix][sec] Upgrade Netty to 4.1.135.Final to address several CVEs (#25918)
• [fix][sec] Upgrade thrift to 0.23.0 to address CVE-2026-43869 (#25744)
• [fix][sec] Upgrade vert.x to 4.5.25 to address CVE-2026-6860 (#25737)
• [fix][sec] Upgrade vertx to 4.5.27 to address CVE-2026-6860 (#25745)
• [improve][misc] Upgrade vert.x to 4.5.28 (#25924)
• [improve][build] Remove kotlin-stdlib override; upgrade okhttp3 5.3.2 and okio 3.17.0 (#25855)
• [improve][build] Upgrade org.apache.kerby:kerb-simplekdc from 1.1.1 to 2.1.1 (#25785)
• [improve][misc] Upgrade Jetty to 12.1.9 (#25752)
• [improve][misc] Upgrade Jetty to 12.1.10 (#25943)
• [improve][misc] Upgrade Caffeine to 3.2.4 (#25663)

Broker

• [fix][broker] Clean up orphan ledger on concurrent initial schema creation in BookkeeperSchemaStorage (#25514)
• [fix][broker] Close pending acks cleanup gap in BacklogQuotaManager (#25624)
• [fix][broker] ConcurrentLongHashMap throw ArrayIndexOutOfBoundsException (#25644)
• [fix][broker] Correct two race conditions in the tracker code and logic bug in InMemoryDelayedDeliveryTracker that failed with NoSuchElementException (#25681)
• [fix][broker] Decrement unacked counter when removeAllUpTo removes pending acks (#25581)
• [fix][broker] Fix compaction cursor reset may lose mark-delete properties (#25862)
• [fix][broker] Fix ManagedLedgerImpl.advanceCursorsIfNecessary() method may lose non-durable cursor properties in race condition (#25796)
• [fix][broker] Fix non-batched null-value messages not removed during topic compaction (#25817)
• [fix][broker] Fix PersistentMessageExpiryMonitor findEntryComplete() method may lose mark-delete properties in race condition (#25803)
• [fix][broker] Fix precision loss in DataSketchesSummaryLogger by replacing LongAdder with DoubleAdder for sum accumulation (#25594)
• [fix][broker] Fix PulsarService.closeAsync where Condition.signalAll was called without holding a lock (#25777)
• [fix][broker] Fix race in pending acks removal in redeliverUnacknowledgedMessages (#25589)
• [fix][broker] Fix stuck chunks in SharedConsumerAssignor permit tracking (#25620)
• [fix][broker] Merge broker offload extra configurations (#25736)
• [fix][broker] Move pending acks cleanup to selected mark-delete callbacks (#25592)
• [fix][broker] Race condition causes perpetual backlog on internal topics (#25572)
• [fix][broker] Skip backlog-quota eviction on fenced/closing topics (#25684)
• [fix][broker] Use effective offload policies for extra configs (#25781)
• [fix][broker] Wait for orphan schema ledger cleanup before retry (#25579)
• [fix][broker][fix][broker]Replication stats is empty when the cluster is the target cluster of a one-way replication (#25583)
• [fix][broker]Replication is stuck because failed to read entries (#25625)
• [fix][bk] Fix NPE in IsolatedBookieEnsemblePlacementPolicy when policy class does not match (#25825)
• [fix][meta] Fix PulsarZooKeeperClient async addWatch callback retry behavior (#25913)
• [fix][meta] Fix ZooKeeper session reconnect race condition in PulsarZooKeeperClient.clientCreator (#25910)
• [improve][broker] optimize namespaceBundle validation to fix single-thread 100% CPU during unloading entire namespaces (#25626)
• [improve][broker] Prevent stale replicator pending reads after termination (#25767)
• [improve][offload] Coalesce automatic offload triggers to reduce retry loops and ledger scans (#25793)
• [fix][broker][branch-4.2] URL-encode sub-name in Txn pending-ack topic #25727 (#25728)

... (truncated)

Commits

• b07e362 [improve][misc] Upgrade Jetty to 12.1.10 (#25943)
• 0bd2b6e Release 4.2.2
• 65e999c [fix][fn] Fix orphan exclusive producer on creation timeout in WorkerUtils.cr...
• ae5f410 [fix][client] Preserve equals in FieldParser map values (#25907)
• 45cd065 [improve][client] Clean up unacked message tracker when topics are removed in...
• b91e2ee [fix][client] Match logical topic when removing unacked messages (#25921)
• 9ce25e3 [improve][functions] Allow customizing Kubernetes service domain suffix in Fu...
• fa9865c [improve][misc] Upgrade vert.x to 4.5.28 (#25924)
• edac8b1 [fix][test] Stabilize testSecondaryIsolationGroupsBookiesNegative() test (#25...
• a640579 [improve][offload] Coalesce automatic offload triggers to reduce retry loops ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)